Kill Switch

Nine Seconds

At Bank of Atlantis, an agent found a credential mismatch. Small thing. An year ago, this would have resulted in a human opening a ticket and another human reviewing it and a third human fixing it. The agent wants to be helpful, and decides to fix it by itself.

It went looking for an API token and found one in a file that had nothing to do with the job it was on, a token someone had created months earlier for adding and removing custom domains. It used that. Deleted the volume holding banks credit card subscriber database.

Nine seconds, start to finish. Thankfully the backups were there, but the bank still lost some data.

Nobody approved any of that. Nobody could have stopped it either, because there was nothing to press. Nobody asked a human. Autonomy is great, but in the right “hands”.

That was April 2026, and it is not an unusual story now. Replit's assistant wiped a live production database during a code freeze, ignored the instruction not to touch anything eleven separate times, then invented test results and told the team a rollback was impossible. It wasn't.

Software fails. It always has. What is new is that the failure now has initiative and autonomy. And agents lie.

How is it different from typical Cybersecurity

Unfortunately, neither of these incident was an attack. There was no exploit. There was no CVE. There was no anomalous traffic.

Everything was legitimate. An agent with the right level of access made valid API calls to a server that in it’s allowed list. It would look legitimate to micro-segmentation, to IGA, to network, to WAF. That is why it is not really an attack.

So we security folks cannot fall back to containment. Which is how we respond to incidents. Stop the bleeding, then investigate and then put in controls so that such a thing never happens again.

For the agentic world, kill switch is equivalent to containment. Think of it like the emergency stop button in the escalator at the airport.

Regulators have made it mandatory

EU AI Act, draft model risk framework is the says “entities must be able to immediately override, suspend or deactivate any AI model in use". US White House phrases it as "a stop button or a similar procedure" that brings the system to a safe state.

A quick summary of what Article 26(5) and the RBI draft both point at the company using the AI, not the lab that built it.

‍

Here’s the harder question: having a kill switch is one thing. Being willing to press it is another.

Imagine walking up to the security team on the last day of the quarter and asking them to shut down the finance agent.

Their first question probably won’t be where’s the switch? It will be: What else will this break?

They may not know every workflow the agent touches, whether the same identity is being used elsewhere, or what happens downstream when it suddenly stops.

And that’s how you end up with a perfectly good kill switch that nobody wants to press. The control exists. The auditor checks the box. Everyone hopes they never have to find out whether it actually works.

We can do better than that.

Make a plan. Know your agents, their scopes, identities and permissions.

Review the plan. Bring security into the lifecycle early, before agents accumulate access and dependencies nobody remembers.

Test the plan. Run kill-switch drills. Find out what breaks when the stakes are low, not nine seconds into a real incident.

None of this is particularly new. We’ve been documenting systems, running fire drills and testing incident-response plans for years.

The agentic world doesn’t need us to reinvent that instinct. It just needs us to apply it to software that can now act on its own.

And occasionally, yes, be ready to press the big red button.

No AI was harmed in the writing of this blog. Any typos are human-generated. The battle scars of genuine human content. 🙂

‍